LiteLLM — agentic threat model

Not certain from the listing — LiteLLM does not host foundation models itself but acts as a gateway to external models (OpenAI, Anthropic, Azure), making it susceptible to upstream model vulnerabilities, adversarial bypasses, or data poisoning of those external endpoints.

Not certain from the listing — LiteLLM does not manage vector databases or training data directly, though it handles prompt/response payloads which could be intercepted or leaked if logging is insecurely configured.

LiteLLM serves as a translation and routing layer rather than an orchestration framework; vulnerabilities here involve proxy-level request manipulation, key exposure, or routing logic bypasses.

As a proxy/package, deployment risks include insecure storage of API keys (environment variables), lack of network isolation, and potential man-in-the-middle (MitM) attacks on outgoing LLM API calls.

LiteLLM includes built-in logging and analytics features, but insecure logging configurations could inadvertently expose sensitive user prompts, API keys, or system responses to third-party logging providers.

LiteLLM acts as a central hub for API keys across multiple providers; a lack of robust access controls, key rotation, or audit logging at this proxy layer poses significant compliance and credential theft risks.

Not certain from the listing — LiteLLM does not natively orchestrate multi-agent marketplaces, but a compromise of this gateway would cascade failures across all downstream agents relying on it for LLM access.